Google launching “Project Shield” to Protect News Websites from DDoS attacks

Now Google will protect news websites from Distributed Denial of Service (DDoS) attack. Google have launched his new initiative “Project Shield” on Thursday for this. It will be a free service for news websites. This initiative is not a new one, it is available since 2013. But only testers were allowed to use it until now. But now Google have launched it publicly.

Google wants to protect news websites from DDoS attacks and Cyber-attacks, especially those websites which are publishing news about oppressive regimes. By doing this, Google will also test Project Shield against DDoS attacks and Cyber-attacks. Google said, it is still a testing phase of Project Shield therefore we are allowing all small and big news websites to server their content through infrastructure of Google without paying a single penny. According to Google, this will be an open initiative for world’s all news websites.

Why Google is doing this?

According to Google, they are supporting free expressions and access to information. Journalism is the important part of any country and it should be active every time. When news websites faced DDoS attacks and Cyber Attacks, it sounds awkward. Cyber-attacks on news websites often happens, when it is needed most. Google is also thinking about to test Project Shield on Election monitoring websites and Human Rights Websites.

Company post a blog on the website of Project Shield, in which they have wrote that Google is launching this initiative because by doing this company will learn new things to protect websites from DDoS attacks. Company also wrote they have designed a proper infrastructure for this initiative but there are no guarantee, how much security it can provide to the websites. Many third party websites can use this initiative and that’s the reason why a number of human rights and election commission websites are applying for this initiative.
Conditions for Qualified Websites?

There are not any difficult things, which admins and webmasters have to learn to understand it. Only basic technical knowledge is required to understand all the processes of Project Shield. The news websites which will use this initiative, need to provide their access to Google. Because the webmasters of Project Shield will monitor all the traffic to find out the malicious activities. The list of all logs and traffics is required to Project Shield for accurate protection.


Google said, there are now thousands of news websites which are allowed to use this Project Shield. Even small individual websites are allowed to use this Project Shield without the fear of Shut down. CDN (Content Delivery Network) is the technique, which can save the companies from DDoS attacks. So the websites which are not using this CDN process could get benefits from Project Shield.

PortonMail encrypted email service, suffered a major DDoS attack in November 2015. World famous British Broadcasting Corporation’s (BBC) websites was also taken offline on December 31, by some hackers. A major DDoS attack was happened at that time and Servers of BBC were getting packets of 600GB per second.

Therefore Google is doing efforts to protect the Journalism of every country from Cyber Attacks and DDoS attacks.

List of data breaches and cyber attacks in February 2016

It’s been a rather quiet month in terms of cyber attacks and data breaches. There have been very few cyber attacks at well-known organisations, and no large-scale thefts of payment card information.

Here is the details of Cyber attacks and data breaches in Feb-2016

Cyber attack

Linux Mint hacked – lone attacker creates botnet

Lincolnshire Council forced to use pen and paper after ransomware attack

Major Hollywood hospital brought down by a ransomware attack demanding $3.6 million

Florists hit by targeted DDoS attacks in run-up to Valentine’s Day

Skype users hit by ads spreading malicious Angler exploit kit

Readers of celebrity gossip site TMZ hit by malvertising campaign

Former Smart Online IT manager sentenced to 30 months for sending damaging code to the firm’s servers

NZ health board hit with ransomware

Kashmir institute under attack said no to security, total data loss feared

DayZ And ArmA 3 Feedback Trackers Offline Due To Potential Security Breach

Flint water crisis hack by Anonymous created hassles for hospital patients

Data breach

Spoofed CEO email causes data breach at health care provider

Sensitive data swiped in Gyft data breach

St. Joseph Hospital employee information leaked in phishing scam

Unauthorized access leads to Neiman Marcus Group breach, 5,200 affected

Vilas County jail inmates had personal info disclosed online

Greenwich University hit by data breach

TaxSlayer suffers data breach affecting tax records of 8,800 customers

Researcher tells child tracking firm it has left its database wide open, and is accused of ‘hacking’

9000+ Department of Homeland Security staff have their details leaked by hacker

Site creates unauthorized searchable database of info of Jacksonville State University students, faculty

Stolen Shire laptop contained patients’ personal and medical info

Quotemehappy? No, I’m furious: Insurance site loses customer details

@ChileanCrew Hacks, Leaks Details for 300,000 Chilean Citizens Looking for State Benefits

Fighting cyber crime

Oregon man pleads guilty to “phishing” celebrity nude photos

Website selling stolen credit card numbers is shut down

British teenager arrested for ‘trying to hack into FBI computer networks’

Beware of LinkedIn frauds

In the recent months I've started noticing something strange too many connection requests from people I do not know. Since I'm working in the cybersecurity industry, I'm very careful with whom I add on LinkedIn. Most of these requests were what I would deem safe, but an alarming number of them started originating from obviously fake profiles.

Most likely for phishing campaigns they are among the most popular means to acquiring a target’s security credentials and personal data. One report revealed a large number of hackers who were speculated to be have operating out of Iran. Creating dozens of fake LinkedIn accounts by posing as corporate headhunters, they sought to snag working professionals in industries such as telecommunications and even government agencies. Once the approach and the trap is laid with successful results, the targets are enticed into giving up information such as business emails.

Acquiring important business emails is key, as this brings hackers the targets that they seek. When a successful phishing campaign is completed, the stolen employees’ sensitive data could be used to engage in more effective phishing campaigns all over again. By gaining access to significant data such as titles, reporting structures and emails, the hackers gain the means to assume the identity of senior management.

Even more-so, communicating through the hacker company emails could see malicious hackers pretend to be a member of the board, the CEO, a senior executive and most times, the CFO. Usually, the communication is made toward an employee who is below the hacker’s assumed position in the corporate hierarchy. There are plenty of instances when an employee is forced to transfer money, at the behest of the faux executive or senior to the hacking impersonator’s account.

Inversely, a hacker could also assume the identity of a supplier to the business, sending in a vendor email that can easily be mistaken as routine communication. Vendor emails are either compromised or spoofed with subtle changes, an extra character here or a removed one there - which would, in essence, make the email appear legitimate. The scale of such an operation only unravels when targeted employees seek to verify the transaction.

Another instance wherein emails are clearly deemed an effective hacking vulnerability is malware-laced attachments that tend to infect targeted computers entirely. The most prominent example of financial malware is that wielded by the Carbanak cyber gang. Altogether, the cybercriminal outfit is speculated to have stolen $1 billion from over 100 financial institutions around the world.

The payload is triggered when banking employees click a phishing email. This particular campaign targeted employees responsible for the handling of the financial institutions’ software and ATM protocols. The malware kicks up a gear with a remote access tool (RAT) that takes snapshots of the targeted computer’s screen before sending it back to an offshore hacker. The credentials displayed on the screen is used to siphon money from the bank accounts to the hackers’ accounts.

All of the above, entirely rendered plausible when hackers and fraudsters are setting up fake LinkedIn profiles.

Significantly, a lot of the fake, fraudster-led profiles have common themes and follow a specific pattern.
They predictably use photos of attractive women from stock images. Several profiles also contain pictures of real professionals, in order to seem more convincing.

The fraudulent accounts assume the identity as a recruiter of a fake firm. Alternatively, they also assume the mantle of being ‘self-employed.’

Lazily, a lot of fake profiles have their content copied from other profiles of real professionals.
The profiles are littered with keywords, so as to ensure that the profile shows up among the top search results.

A lot of LinkedIn users are looking for better employment opportunities or, at the very least, seeking to catch the eye of a recruiter. Posing as a recruiter was the obvious choice for fraudulent users.

The epidemic of fake profiles grew to such an extent that the BBC published a story covering a report by security firm Symantec.

Security researcher Dick O-Brien told the publication: "Most of these fake accounts have been quite successful in gaining a significant network one had 500 contacts. Some even managed to get endorsements from others."

For its part, LinkedIn is usually adept in suspending accounts that are clearly in violation of certain rules set by the company, including one which decries the creation of fake profiles.

Dell’s counter-threat unit identified at least 25 fake profiles which, bemusingly, had links to over 200 legitimate LinkedIn profiles.